Secure DNS (DNSSEC)

Multiple RR types in parallel via Cloudflare DoH (1.1.1.1) with DO bit; AD shows resolver DNSSEC validation.